personal data in the field of employment law is one of the grounds that allow
derogating from the prohibition on processing special categories of personal data
(see this chapter, Sect. 1.3, supra).
According to Article 88 of the GDPR, Member State law or collective agreements
may provide for specific rules on the processing of employees’ personal data in the
employment context, in particular for the conditions under which personal data in the
employment context may be processed. Those rules shall include suitable and
specific measures to safeguard the data subject’s human dignity, legitimate interests
and fundamental rights.
2.5 Data Security and Data Breach
The basic storage limitation in the GDPR is applicable to data conveyed and stored
through electronic means. Pursuant to Article 5(1)(e) of the GDPR a basic principle
relating to the processing of personal data is that such data shall be kept in a form
which permits identification of data subjects for no longer than is necessary for the
purposes for which the personal data are processed. At the time when personal data
are obtained, the controller is obliged to provide the data subject information
regarding the period for which the personal data will be stored, or if that is not
possible, the criteria used to determine that period. Moreover, pursuant to Article
25 of the GDPR the controller is under an obligation to implement measures for
ensuring that, by default, only personal data which are necessary for each specific
purpose of the processing are processed, including the period of their storage.
Furthermore, pursuant to Article 32, the controller and the processor are obliged to
implement technical and organisational measures, such as encryption, to ensure a
level of security appropriate to the risks inherent in the processing. Such risks
include accidental or unlawful destruction, loss, alteration, unauthorised disclosure
of, or access to personal data transmitted or stored.
The GDPR establishes specific obligations on controllers to notify a personal data
breach to the supervisory authority (art. 33) and to the data subject (art. 34). A
definition of ‘personal data breach’ is provided for in Article 4(12) of the GDPR. It
means a “breach of security leading to the accidental or unlawful destruction, loss,
alteration, unauthorised disclosure of, or access to, personal data transmitted, stored
or otherwise processed”.
An obligation is imposed on the controller to notify the personal data breach to
the supervisory authority without undue delay and, where feasible, not later than
72 h after having become aware of it, unless the controller is able to demonstrate that
the breach is unlikely to result in a risk to the rights and freedoms of natural persons.
Such notification shall include information on the nature of the breach including
where possible, the categories and approximate number of data subjects and personal
data records concerned; the likely consequences of the breach; and the measures
taken or proposed to be taken by the controller. The obligation of the controller to
communicate the personal data breach to the data subject without undue delay
466
P. A. de Miguel Asensio
derogating from the prohibition on processing special categories of personal data
(see this chapter, Sect. 1.3, supra).
According to Article 88 of the GDPR, Member State law or collective agreements
may provide for specific rules on the processing of employees’ personal data in the
employment context, in particular for the conditions under which personal data in the
employment context may be processed. Those rules shall include suitable and
specific measures to safeguard the data subject’s human dignity, legitimate interests
and fundamental rights.
2.5 Data Security and Data Breach
The basic storage limitation in the GDPR is applicable to data conveyed and stored
through electronic means. Pursuant to Article 5(1)(e) of the GDPR a basic principle
relating to the processing of personal data is that such data shall be kept in a form
which permits identification of data subjects for no longer than is necessary for the
purposes for which the personal data are processed. At the time when personal data
are obtained, the controller is obliged to provide the data subject information
regarding the period for which the personal data will be stored, or if that is not
possible, the criteria used to determine that period. Moreover, pursuant to Article
25 of the GDPR the controller is under an obligation to implement measures for
ensuring that, by default, only personal data which are necessary for each specific
purpose of the processing are processed, including the period of their storage.
Furthermore, pursuant to Article 32, the controller and the processor are obliged to
implement technical and organisational measures, such as encryption, to ensure a
level of security appropriate to the risks inherent in the processing. Such risks
include accidental or unlawful destruction, loss, alteration, unauthorised disclosure
of, or access to personal data transmitted or stored.
The GDPR establishes specific obligations on controllers to notify a personal data
breach to the supervisory authority (art. 33) and to the data subject (art. 34). A
definition of ‘personal data breach’ is provided for in Article 4(12) of the GDPR. It
means a “breach of security leading to the accidental or unlawful destruction, loss,
alteration, unauthorised disclosure of, or access to, personal data transmitted, stored
or otherwise processed”.
An obligation is imposed on the controller to notify the personal data breach to
the supervisory authority without undue delay and, where feasible, not later than
72 h after having become aware of it, unless the controller is able to demonstrate that
the breach is unlikely to result in a risk to the rights and freedoms of natural persons.
Such notification shall include information on the nature of the breach including
where possible, the categories and approximate number of data subjects and personal
data records concerned; the likely consequences of the breach; and the measures
taken or proposed to be taken by the controller. The obligation of the controller to
communicate the personal data breach to the data subject without undue delay
466
P. A. de Miguel Asensio